CVE-2026-81167: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Address Suggestion

The Drupal Address Suggestion module suffers from a CWE-79 Cross-Site Scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges and requiring user interaction to inject malicious scripts, potentially leading to partial confidentiality and integrity impacts. The vulnerability affects versions from 0.0.0 through 1.0.25. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute scripts in the context of the affected application, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability reported. No known active exploitation is documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply strict input validation and sanitization where possible and limit exposure of the vulnerable module to trusted users only.